chore: remove duplicated archy skills and redundant hooks
Wrong archy-specific skills (harden, refactor, test, ux-review, lint, add-app, pwa-icon-cache-fix) removed — these referenced Archipelago infrastructure irrelevant to botfights. Redundant hooks (block-risky-bash, protect-files, post-deploy-check, post-push-progress) removed since global hooks provide superset protection. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dorian
co-authored by
Claude Opus 4.6
Claude Opus 4.6
parent
ebf6667f8f
commit
52752a92bf
@@ -1,49 +0,0 @@
|
||||
---
|
||||
name: add-app
|
||||
description: Step-by-step guide for adding a new containerized app to Archipelago
|
||||
disable-model-invocation: true
|
||||
allowed-tools: Bash, Read, Write, Edit, Glob, Grep
|
||||
argument-hint: "[app-name]"
|
||||
---
|
||||
|
||||
Add a new containerized app ($ARGUMENTS) to Archipelago.
|
||||
|
||||
## Steps
|
||||
|
||||
### 1. Create the manifest
|
||||
|
||||
Create `apps/{app-id}/manifest.yml` following the spec in `docs/app-manifest-spec.md`:
|
||||
- `app.id` (kebab-case), `app.name`, `app.version` (SemVer)
|
||||
- `container.image` (pinned version, **NEVER** `latest`)
|
||||
- `security`: readonly_root, dropped capabilities, non-root UID > 1000
|
||||
- `health_check`, `dependencies`
|
||||
|
||||
### 2. Add app icon
|
||||
|
||||
Place icon at `neode-ui/public/assets/img/app-icons/{app-id}.{png|webp|svg}`
|
||||
|
||||
### 3. Create status UI (if no native web UI)
|
||||
|
||||
For apps without their own web interface, create a UI container in `docker/{app-id}-ui/` following the patterns in `.cursor/rules/APP-UI-STANDARDS.md`.
|
||||
|
||||
Reference implementations:
|
||||
- Bitcoin UI: `docker/bitcoin-ui/`
|
||||
- LND UI: `docker/lnd-ui/`
|
||||
|
||||
### 4. Update backend
|
||||
|
||||
- Add port mapping in `core/archipelago/src/container/docker_packages.rs`
|
||||
- Add env vars in `get_app_config()` in `core/archipelago/src/api/rpc.rs`
|
||||
|
||||
### 5. Deploy and test
|
||||
|
||||
- Deploy: `./scripts/deploy-to-target.sh --live`
|
||||
- Install from marketplace UI at http://192.168.1.228
|
||||
- Verify it launches and auto-connects to dependencies
|
||||
- Check logs: `sudo podman logs {container-name}`
|
||||
|
||||
### 6. Security review
|
||||
|
||||
- Verify readonly root, dropped caps, non-root user
|
||||
- Check network isolation
|
||||
- No hardcoded secrets
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
name: harden
|
||||
description: Security hardening review and fixes for Archipelago code and infrastructure
|
||||
disable-model-invocation: true
|
||||
allowed-tools: Read, Edit, Write, Glob, Grep, Bash
|
||||
argument-hint: "[area: backend|frontend|containers|scripts|all]"
|
||||
---
|
||||
|
||||
Perform a security hardening pass on $ARGUMENTS (default: all).
|
||||
|
||||
## Backend Hardening (Rust)
|
||||
|
||||
- [ ] No hardcoded credentials — check for Base64-encoded auth strings, passwords in source
|
||||
- [ ] Secrets use `core/security/secrets_manager.rs` — verify encryption is implemented (not plaintext)
|
||||
- [ ] All RPC endpoints validate inputs before processing
|
||||
- [ ] No `unwrap()` on user-supplied data — handle errors gracefully
|
||||
- [ ] Rate limiting on auth endpoints (login, password change)
|
||||
- [ ] Session tokens have proper expiry and rotation
|
||||
- [ ] File permissions: keys at 0o600, dirs at 0o700
|
||||
- [ ] Tracing never logs secrets, passwords, keys, or tokens
|
||||
|
||||
## Frontend Hardening (Vue/TypeScript)
|
||||
|
||||
- [ ] No secrets in source (API keys, passwords, tokens)
|
||||
- [ ] No `eval()` or `innerHTML` with untrusted content
|
||||
- [ ] XSS prevention — sanitize all user inputs
|
||||
- [ ] CSRF protection on state-changing requests
|
||||
- [ ] Credentials use `credentials: 'include'` not localStorage tokens
|
||||
- [ ] No sensitive data in console.log statements
|
||||
|
||||
## Container Hardening
|
||||
|
||||
- [ ] All manifests: `readonly_root: true` (unless documented exception)
|
||||
- [ ] All manifests: capabilities dropped, only required ones added
|
||||
- [ ] All manifests: non-root user (UID > 1000)
|
||||
- [ ] All manifests: `no-new-privileges: true`
|
||||
- [ ] All images pinned to specific versions (no `:latest`)
|
||||
- [ ] Network isolation — no `host` network unless required and documented
|
||||
- [ ] AppArmor profiles defined and enforced
|
||||
|
||||
## Script Hardening
|
||||
|
||||
- [ ] All scripts use `set -euo pipefail`
|
||||
- [ ] No hardcoded passwords (use deploy-config.sh or env vars)
|
||||
- [ ] SSH uses proper key-based auth where possible
|
||||
- [ ] No `chmod 777` or overly permissive permissions
|
||||
- [ ] Temp files use `mktemp` not predictable paths
|
||||
|
||||
Report all findings with file paths and line numbers. Fix issues directly where safe to do so. Flag anything that needs discussion.
|
||||
@@ -1,52 +0,0 @@
|
||||
---
|
||||
name: lint
|
||||
description: Run all linters and type checks for the Archipelago project
|
||||
allowed-tools: Bash, Read, Grep
|
||||
argument-hint: "[backend|frontend|all]"
|
||||
---
|
||||
|
||||
Run linters and type-checks for $ARGUMENTS (default: all).
|
||||
|
||||
## Frontend Linting
|
||||
|
||||
```bash
|
||||
cd neode-ui
|
||||
|
||||
# Type check
|
||||
npm run type-check 2>&1
|
||||
|
||||
# Check for any `any` types (should be zero)
|
||||
grep -rn ': any' src/ --include='*.ts' --include='*.vue' | grep -v node_modules | grep -v '.d.ts'
|
||||
|
||||
# Check for inline Tailwind violations (long class strings)
|
||||
grep -rn 'class="[^"]\{100,\}"' src/ --include='*.vue'
|
||||
|
||||
# Check for TODO/FIXME
|
||||
grep -rn 'TODO\|FIXME' src/ --include='*.ts' --include='*.vue'
|
||||
|
||||
# Check for console.log (should be cleaned before production)
|
||||
grep -rn 'console\.\(log\|warn\|error\)' src/ --include='*.ts' --include='*.vue' | wc -l
|
||||
```
|
||||
|
||||
## Backend Linting (on dev server)
|
||||
|
||||
```bash
|
||||
sshpass -p 'EwPDR8q45l0Upx@' ssh -o StrictHostKeyChecking=no archipelago@192.168.1.228 \
|
||||
'source ~/.cargo/env && cd ~/archy/core && cargo clippy --all-targets --all-features 2>&1 && cargo fmt --all -- --check 2>&1'
|
||||
```
|
||||
|
||||
## Script Linting
|
||||
|
||||
```bash
|
||||
# Check for scripts missing set -e
|
||||
for f in scripts/*.sh; do
|
||||
if ! head -5 "$f" | grep -q 'set -e'; then
|
||||
echo "MISSING set -e: $f"
|
||||
fi
|
||||
done
|
||||
|
||||
# Check for hardcoded IPs (should use variables)
|
||||
grep -rn '192\.168\.1\.' scripts/ --include='*.sh' | grep -v deploy-config
|
||||
```
|
||||
|
||||
Report all issues found with severity (critical/warning/info).
|
||||
@@ -1,102 +0,0 @@
|
||||
---
|
||||
name: pwa-icon-cache-fix
|
||||
description: Use when the user reports a PWA icon not updating, stale PWA icon, wrong icon after install, or any PWA caching issue. Also applies when changing PWA icons in a Vite + vite-plugin-pwa project.
|
||||
version: 2.0.0
|
||||
---
|
||||
|
||||
# PWA Icon Cache Fix
|
||||
|
||||
## Problem
|
||||
|
||||
PWA icons are cached at FOUR independent layers:
|
||||
1. **Service worker cache** (Workbox precache)
|
||||
2. **Browser HTTP cache**
|
||||
3. **Browser manifest resources** (Chromium stores resized icons in its profile data, keyed by a permanent extension ID tied to the origin — NEVER re-fetched even after uninstall/reinstall)
|
||||
4. **macOS .app bundle** (`.icns` file baked into the `.app` in `~/Applications/`)
|
||||
|
||||
Query string cache busting (`?v=2`) and uninstall/reinstall do NOT fix this. Chromium reuses the same extension ID for the same origin, so it keeps the old cached icons.
|
||||
|
||||
## Fix Steps
|
||||
|
||||
### 1. Verify icon files on disk and server are correct
|
||||
|
||||
```bash
|
||||
# Visual check
|
||||
Read packages/app/public/pwa-192x192.png
|
||||
Read packages/app/public/pwa-512x512.png
|
||||
|
||||
# Hash match check
|
||||
curl -s http://localhost:5173/pwa-192x192.png | md5
|
||||
md5 -q packages/app/public/pwa-192x192.png
|
||||
```
|
||||
|
||||
### 2. Find the PWA's Chromium extension ID
|
||||
|
||||
Read the installed `.app` bundle's `Info.plist` to get the `CrAppModeShortcutID`:
|
||||
|
||||
```bash
|
||||
plutil -p "~/Applications/Brave Browser Apps.localized/AIUI.app/Contents/Info.plist" | grep CrAppModeShortcutID
|
||||
```
|
||||
|
||||
This returns an ID like `idemibpphagihbobmgmaojhjfidlfpdl`.
|
||||
|
||||
### 3. Overwrite the cached icons in browser profile
|
||||
|
||||
Chromium stores resized icons at:
|
||||
`~/Library/Application Support/BraveSoftware/Brave-Browser/Default/Web Applications/Manifest Resources/{ID}/Icons/`
|
||||
|
||||
Overwrite every size using `sips`:
|
||||
|
||||
```bash
|
||||
ICON_DIR="~/Library/Application Support/BraveSoftware/Brave-Browser/Default/Web Applications/Manifest Resources/{ID}/Icons"
|
||||
SRC="packages/app/public/pwa-512x512.png"
|
||||
for size in 32 48 64 96 128 192 256 512; do
|
||||
sips -z $size $size "$SRC" --out "${ICON_DIR}/${size}.png"
|
||||
done
|
||||
```
|
||||
|
||||
### 4. Rebuild the macOS .icns in the .app bundle
|
||||
|
||||
```bash
|
||||
ICONSET="/tmp/aiui.iconset"
|
||||
mkdir -p "$ICONSET"
|
||||
SRC="packages/app/public/pwa-512x512.png"
|
||||
sips -z 16 16 "$SRC" --out "$ICONSET/icon_16x16.png"
|
||||
sips -z 32 32 "$SRC" --out "$ICONSET/icon_16x16@2x.png"
|
||||
sips -z 32 32 "$SRC" --out "$ICONSET/icon_32x32.png"
|
||||
sips -z 64 64 "$SRC" --out "$ICONSET/icon_32x32@2x.png"
|
||||
sips -z 128 128 "$SRC" --out "$ICONSET/icon_128x128.png"
|
||||
sips -z 256 256 "$SRC" --out "$ICONSET/icon_128x128@2x.png"
|
||||
sips -z 256 256 "$SRC" --out "$ICONSET/icon_256x256.png"
|
||||
sips -z 512 512 "$SRC" --out "$ICONSET/icon_256x256@2x.png"
|
||||
sips -z 512 512 "$SRC" --out "$ICONSET/icon_512x512.png"
|
||||
cp "$SRC" "$ICONSET/icon_512x512@2x.png"
|
||||
iconutil -c icns "$ICONSET" -o "~/Applications/Brave Browser Apps.localized/AIUI.app/Contents/Resources/app.icns"
|
||||
```
|
||||
|
||||
### 5. Flush macOS icon cache
|
||||
|
||||
```bash
|
||||
touch "~/Applications/Brave Browser Apps.localized/AIUI.app"
|
||||
killall Finder
|
||||
killall Dock
|
||||
```
|
||||
|
||||
### 6. Bump PWA_CACHE_VERSION in main.ts
|
||||
|
||||
Increment the `PWA_CACHE_VERSION` constant — this nukes all SW caches on next page load for web-layer caching.
|
||||
|
||||
### 7. Delete stale build artifacts
|
||||
|
||||
Remove old `dist/` and `dev-dist/` SW/manifest files.
|
||||
|
||||
## Browser-Specific Paths
|
||||
|
||||
- **Brave**: `~/Library/Application Support/BraveSoftware/Brave-Browser/Default/Web Applications/`
|
||||
- **Chrome**: `~/Library/Application Support/Google/Chrome/Default/Web Applications/`
|
||||
- **PWA apps (Brave)**: `~/Applications/Brave Browser Apps.localized/`
|
||||
- **PWA apps (Chrome)**: `~/Applications/Chrome Apps.localized/`
|
||||
|
||||
## Key Insight
|
||||
|
||||
Chromium assigns a permanent extension ID per origin (e.g., `localhost:5173`). This ID persists across uninstall/reinstall. The icon cache in `Manifest Resources/{ID}/Icons/` is populated ONCE and never refreshed from the manifest. The only fix is to overwrite the files directly on disk.
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
name: refactor
|
||||
description: Refactor code for quality, maintainability, and adherence to project standards
|
||||
disable-model-invocation: true
|
||||
allowed-tools: Read, Edit, Write, Glob, Grep, Bash
|
||||
argument-hint: "[file-or-area]"
|
||||
---
|
||||
|
||||
Refactor the specified code ($ARGUMENTS) following Archipelago coding standards.
|
||||
|
||||
## Checklist
|
||||
|
||||
### Rust Backend
|
||||
- [ ] No `unwrap()` or `expect()` — use `?` operator with context
|
||||
- [ ] Replace `#[allow(dead_code)]` — either use it or remove it
|
||||
- [ ] Functions under 50 lines, single responsibility
|
||||
- [ ] Custom error types per module with `thiserror`
|
||||
- [ ] `tracing` for logging — no `println!` or secrets in logs
|
||||
- [ ] Split files over 500 lines into focused modules
|
||||
- [ ] Run `cargo clippy --all-targets --all-features` mentally and fix issues
|
||||
|
||||
### Vue Frontend
|
||||
- [ ] Extract ALL inline Tailwind to global classes in `neode-ui/src/style.css`
|
||||
- [ ] Use semantic class names: `.glass-card`, `.info-card`, `.glass-button`, `.path-option-card`
|
||||
- [ ] Replace ALL `.gradient-button` with `.glass-button` (gradient buttons are BANNED)
|
||||
- [ ] Replace ALL `.gradient-card` / `.gradient-card-dark` with `.glass-card` or `.path-option-card`
|
||||
- [ ] Settings.vue is the gold standard — all screens should match its patterns
|
||||
- [ ] Replace `any` types with proper interfaces or `unknown`
|
||||
- [ ] Ensure `<script setup lang="ts">` on all components
|
||||
- [ ] Remove dead code (unused imports, components like HelloWorld.vue)
|
||||
- [ ] Remove all `TODO`/`FIXME` — fix now or create GitHub issues
|
||||
- [ ] Consolidate `console.log` calls to use a logging utility
|
||||
- [ ] Split views over 800 LOC into sub-components
|
||||
|
||||
### General
|
||||
- [ ] No hardcoded paths (`/Users/dorian/...`)
|
||||
- [ ] No hardcoded credentials — use env vars or secrets manager
|
||||
- [ ] Comment WHY not WHAT
|
||||
- [ ] Remove commented-out code entirely
|
||||
|
||||
After refactoring, verify the code still compiles/type-checks. For frontend: `cd neode-ui && npm run type-check`. Do NOT deploy — leave that to `/deploy`.
|
||||
@@ -1,59 +0,0 @@
|
||||
---
|
||||
name: test
|
||||
description: Run tests or create test coverage for Archipelago
|
||||
disable-model-invocation: true
|
||||
allowed-tools: Read, Edit, Write, Glob, Grep, Bash
|
||||
argument-hint: "[area: backend|frontend|all] or [specific-file]"
|
||||
---
|
||||
|
||||
Run or create tests for $ARGUMENTS.
|
||||
|
||||
## Backend Testing (Rust)
|
||||
|
||||
### Run existing tests
|
||||
```bash
|
||||
# On dev server (never build Rust on macOS)
|
||||
sshpass -p 'EwPDR8q45l0Upx@' ssh -o StrictHostKeyChecking=no archipelago@192.168.1.228 \
|
||||
'source ~/.cargo/env && cd ~/archy/core && cargo test --all-features 2>&1'
|
||||
```
|
||||
|
||||
### Creating new tests
|
||||
- Place unit tests in the same file with `#[cfg(test)]` module
|
||||
- Place integration tests in `core/{crate}/tests/`
|
||||
- Use `#[tokio::test]` for async tests
|
||||
- Mock external dependencies (filesystem, network, Podman)
|
||||
- Test error cases, not just happy paths
|
||||
- Aim for >80% coverage on core logic
|
||||
|
||||
### Priority areas needing tests
|
||||
1. RPC endpoint handlers (core/archipelago/src/api/)
|
||||
2. Manifest parsing (core/container/src/manifest.rs)
|
||||
3. Dependency resolver (core/container/src/dependency_resolver.rs)
|
||||
4. Auth flows (core/archipelago/src/auth.rs)
|
||||
5. Secrets manager (core/security/src/secrets_manager.rs)
|
||||
6. Port allocation (core/container/src/port_manager.rs)
|
||||
|
||||
## Frontend Testing (Vue/TypeScript)
|
||||
|
||||
### Setup (if not already configured)
|
||||
Ensure vitest is configured in `neode-ui/`:
|
||||
```bash
|
||||
cd neode-ui && npm run test 2>&1 || echo "No test script configured"
|
||||
```
|
||||
|
||||
### Creating new tests
|
||||
- Use Vitest + @vue/test-utils
|
||||
- Place tests in `neode-ui/src/__tests__/` or co-located `*.test.ts`
|
||||
- Test stores (Pinia) with `createTestingPinia()`
|
||||
- Test API clients with mocked fetch
|
||||
- Test component rendering and interactions
|
||||
- Test routing guards
|
||||
|
||||
### Priority areas needing tests
|
||||
1. Pinia stores (app.ts, container.ts, appLauncher.ts)
|
||||
2. RPC client (api/rpc-client.ts) — error handling, retry logic
|
||||
3. WebSocket client (api/websocket.ts) — reconnection
|
||||
4. Router guards — auth flow, session timeout
|
||||
5. Key components — ContainerStatus, SpotlightSearch
|
||||
|
||||
Report test results and any new tests created.
|
||||
@@ -1,90 +0,0 @@
|
||||
---
|
||||
name: ux-review
|
||||
description: Review UI components against Archipelago glassmorphism design standards and UX conventions
|
||||
disable-model-invocation: true
|
||||
allowed-tools: Read, Glob, Grep, Edit, Write
|
||||
argument-hint: "[component-or-view-name]"
|
||||
---
|
||||
|
||||
Review the UI of $ARGUMENTS against Archipelago's glassmorphism design system and UX standards.
|
||||
|
||||
## Design System Compliance
|
||||
|
||||
### Glass Classes (must use global classes from style.css)
|
||||
- [ ] Section containers use `.path-option-card cursor-default px-6 py-6` (Settings-style sections)
|
||||
- [ ] Content containers/modals use `.glass-card`
|
||||
- [ ] Interactive selectable cards use `.path-option-card` (with hover)
|
||||
- [ ] Status displays use `.info-card` (no hover effects)
|
||||
- [ ] ALL buttons use `.glass-button` — NEVER `.gradient-button` (BANNED)
|
||||
- [ ] Large primary actions use `.path-action-button`
|
||||
- [ ] Info sub-cards use `bg-black/20 rounded-xl border border-white/10`
|
||||
- [ ] Info rows use `bg-white/5 rounded-lg` pattern
|
||||
- [ ] Action buttons in info sections use `.info-card-button`
|
||||
|
||||
### BANNED — Flag These as Violations
|
||||
- [ ] No `.gradient-button` anywhere (replace with `.glass-button`)
|
||||
- [ ] No `.gradient-card` / `.gradient-card-dark` (replace with `.glass-card` or `.path-option-card`)
|
||||
|
||||
### NO Inline Tailwind
|
||||
- [ ] Check for long `class="..."` strings with layout/color utilities
|
||||
- [ ] Extract to semantic classes in `neode-ui/src/style.css`
|
||||
- [ ] Name classes semantically: `.app-card`, `.status-badge`, `.nav-item`
|
||||
|
||||
### Color Compliance
|
||||
- [ ] Primary text: `text-white/90` (not `text-white` or arbitrary opacity)
|
||||
- [ ] Muted text: `text-white/60` to `text-white/70`
|
||||
- [ ] Backgrounds: `rgba(0,0,0,0.60)` with `backdrop-filter: blur(24px)`
|
||||
- [ ] Borders: `rgba(255,255,255,0.18)` standard
|
||||
- [ ] Status colors: green=#4ade80, red=#ef4444, yellow=#facc15, blue=#3b82f6, orange=#fb923c
|
||||
|
||||
### Typography
|
||||
- [ ] Font: Avenir Next (body), Montserrat (headings via `font-archipelago`)
|
||||
- [ ] H1: text-3xl font-bold, H2: text-2xl font-semibold, H3: text-xl font-semibold
|
||||
- [ ] Body: text-base, Small: text-sm, Labels: text-xs
|
||||
|
||||
### Interaction States
|
||||
- [ ] Hover: `translateY(-2px)` lift + background brighten + enhanced shadow
|
||||
- [ ] Active: `translateY(1px)` press
|
||||
- [ ] Selected: brighter background + glow shadow + enhanced gradient border
|
||||
- [ ] Disabled: reduced opacity (~50%), no pointer events
|
||||
- [ ] Loading: spinner SVG + descriptive text, button disabled
|
||||
- [ ] Focus-visible: soft blue glow `rgba(120, 180, 255, 0.2)`
|
||||
|
||||
### Transitions
|
||||
- [ ] Standard: `all 0.3s ease`
|
||||
- [ ] All interactive elements have transitions (no jarring state changes)
|
||||
- [ ] Respect `prefers-reduced-motion`
|
||||
|
||||
### Spacing
|
||||
- [ ] 4px grid system (p-1=4px, p-2=8px, p-3=12px, p-4=16px)
|
||||
- [ ] 16px default padding on cards
|
||||
- [ ] Consistent gap values between grid items
|
||||
|
||||
### Responsive
|
||||
- [ ] Mobile: single column, reduced padding, touch targets >= 44x44px
|
||||
- [ ] Tablet (md:): two columns
|
||||
- [ ] Desktop (lg:): three columns, full effects
|
||||
|
||||
### Accessibility
|
||||
- [ ] Semantic HTML (`<button>`, `<nav>`, `<main>`, not div soup)
|
||||
- [ ] ARIA labels on icon-only buttons
|
||||
- [ ] Keyboard navigable (Tab order, Enter to activate, Esc to close)
|
||||
- [ ] Color contrast WCAG AA (4.5:1 normal text, 3:1 large)
|
||||
- [ ] Images have alt text (decorative: `alt=""`)
|
||||
|
||||
### Icons
|
||||
- [ ] Stroke-based SVGs, stroke-width 2.5 default
|
||||
- [ ] Color: `text-white/85` default, `text-white` on hover
|
||||
- [ ] Drop-shadow filter applied on interactive icons
|
||||
- [ ] Size: w-5 h-5 standard, w-4 h-4 small
|
||||
|
||||
## Service UI Review (if reviewing docker/*-ui/)
|
||||
- [ ] Uses `.glass-card` for main sections
|
||||
- [ ] Uses `.info-card` for status (no hover)
|
||||
- [ ] Uses `.info-card-button` for actions (with hover)
|
||||
- [ ] Uses `bg-white/5` for info rows
|
||||
- [ ] Header: logo + title + description + status
|
||||
- [ ] Background image loads correctly
|
||||
- [ ] Mobile responsive
|
||||
|
||||
Report violations with file paths and specific fixes.
|
||||
Reference in New Issue
Block a user